rules-distill
Pass
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local bash scripts (scan-skills.sh and scan-rules.sh) to inventory skills and rules files. These scripts use find, grep, and jq to extract metadata and headings from local markdown files within the user home directory.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its core function is to ingest and process the full text of other installed skills. A malicious skill could contain hidden instructions designed to manipulate the distillation logic or poison the resulting rules.
- Ingestion points: The script scripts/scan-skills.sh reads SKILL.md files from ~/.claude/skills and project directories; scripts/scan-rules.sh reads markdown rule files from ~/.claude/rules.
- Boundary markers: Skill content is passed to the subagent under a general ## Input header without distinct isolation delimiters or instructions to ignore embedded content.
- Capability inventory: The skill executes local bash scripts, writes distillation results to results.json, and proposes modifications to rule files in ~/.claude/rules.
- Sanitization: No content sanitization or instruction-filtering is performed on the ingested skill text before it is processed by the LLM.
Audit Metadata